I know we can grab the user's session ID in apex by using UserInfo.getSessionID() but what limitations are there as to what rest endpoints it can use and also is there any way for me externally to verify the token as to whether it is a valid token and the username/userid of the token.
The Session ID is limited to whatever the parent session is limited to. For example, using the REST API, you'd have access to whatever APIs are within the
scope of the OAuth session that was authorized, while in Lightning, you'd be limited to just the
UI API methods, as the Lightning Session ID doesn't include REST or SOAP API access.